chore(extension): prep Chrome Web Store submission

- manifest v1.0.0; drop unused 'scripting' + redundant 'activeTab' perms
  (smaller permission footprint → smoother review); add homepage_url
- STORE-LISTING.md: descriptions, single-purpose, per-permission
  justifications, privacy-practice answers, screenshot specs, checklist
- host a privacy policy at web /privacy (required for OAuth/Drive apps);
  link it from the landing footer
- update build-smoke to assert the trimmed permission set

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: tech-sumit

apps/extension/STORE-LISTING.md

@@ -0,0 +1,126 @@
+# Chrome Web Store submission — PromptVault
+
+Everything you need to fill the CWS dashboard. The upload artifact is
+`apps/extension/promptvault-extension.zip` (built from `dist/`).
+
+---
+
+## Item basics
+
+- **Name:** PromptVault
+- **Version:** 1.0.0 (from `manifest.json`)
+- **Category:** Productivity
+- **Language:** English (United Kingdom) / English
+
+## Short description (≤ 132 chars)
+
+```
+Save reusable AI prompts in your own Google Drive and inject them into Claude, ChatGPT, Gemini, or any text field.
+```
+
+## Detailed description
+
+```
+PromptVault is a clipboard manager built for AI prompts. Save the instructions you retype every day — prefaces, guardrails, personas, personal context, snippets — and drop any of them into Claude, ChatGPT, Gemini, or any text field on the web with a click or a right-click.
+
+WHY PROMPTVAULT
+• Your library, your storage. Prompts live in YOUR Google Drive (in a single PromptVault folder), not on our servers — because we don't run any.
+• Works everywhere you type. Inject a saved prompt at the cursor in any website's text box, or capture selected text into your library.
+• Organised. Categories, tags, and instant search.
+• Private. No accounts to create with us, no analytics, no telemetry, no ads.
+• Free forever. It uses storage you already own.
+
+HOW IT WORKS
+1. Install and open the setup page.
+2. Connect your Google account (least-privilege access — PromptVault can only see the files it creates).
+3. Save prompts, then right-click or use the toolbar popup to inject them anywhere.
+
+The companion web app at https://prompt-vault-01.web.app manages the same library from any browser.
+
+PromptVault requests only the drive.file and email scopes, and its use of Google user data follows the Google API Services User Data Policy, including the Limited Use requirements.
+```
+
+## Privacy policy URL (required)
+
+```
+https://prompt-vault-01.web.app/privacy
+```
+
+## Homepage / support URL
+
+```
+https://prompt-vault-01.web.app
+```
+
+---
+
+## Single purpose (required field)
+
+```
+PromptVault stores reusable text prompts in the user's own Google Drive and inserts a chosen prompt into the focused text field on any website.
+```
+
+## Permission justifications (paste one per permission)
+
+| Permission | Justification |
+|---|---|
+| `storage` | Caches the user's prompt library locally for fast, offline access between sessions. |
+| `identity` | Lets the user sign in to their own Google account so prompts can be stored in their Google Drive. Uses `chrome.identity.launchWebAuthFlow`; no credentials are seen by the extension. |
+| `contextMenus` | Adds the right-click items "Inject prompt" and "Save selection to PromptVault". |
+| `clipboardWrite` | Copies a prompt to the clipboard as a fallback when no editable field is focused at injection time. |
+| `alarms` | Schedules a periodic background sync of the prompt library with the user's Google Drive. |
+| **Host permission `<all_urls>`** | The core feature inserts a user-selected prompt into the focused text field on whatever site the user is on. A content script must be able to run on all sites to do this. The content script only writes the chosen prompt's text into a field — it never reads or transmits page content. |
+| Host `https://www.googleapis.com/*` | Calls the Google Drive API to read/write the user's PromptVault folder and `vault.json`. |
+| Host `https://accounts.google.com/*` | Google sign-in / OAuth flow. |
+
+**Are you using remote code?** No. All JavaScript is bundled in the package; the extension loads no external scripts. (Authentication uses Chrome's built-in `chrome.identity` API.)
+
+---
+
+## Privacy practices / data usage (the certification form)
+
+PromptVault transmits data only between the user's browser and the user's own Google account; **the developer operates no server and collects nothing**. Recommended answers:
+
+- **Data handled:** *Authentication information* (an OAuth token + the account email, kept on-device / used only to access the user's own Drive). Prompts are user-authored text stored in the user's own Drive. No other categories (no location, financial, health, web history, etc.).
+- **Sold to third parties?** No.
+- Tick all three required certifications:
+  - ☑ I do not sell or transfer user data to third parties outside the approved use cases.
+  - ☑ I do not use or transfer user data for purposes unrelated to my item's single purpose.
+  - ☑ I do not use or transfer user data to determine creditworthiness or for lending.
+
+> Note: "collect" on this form means transmitting data off the device to the developer or third parties. PromptVault does neither — data goes only to the user's own Google Drive. If the form requires you to declare data that *leaves the device at all*, declare **Authentication information** and **Personal communications** (the prompt text), and rely on the certifications above.
+
+---
+
+## Graphics
+
+Required:
+- **Store icon 128×128** — `dist/icon128.png` (included).
+- **At least 1 screenshot** — 1280×800 or 640×400, PNG/JPEG (up to 5).
+
+Optional:
+- Small promo tile 440×280; Marquee 1400×560.
+
+### Screenshots to capture (load the unpacked extension first — see below)
+1. The toolbar **popup** showing a few saved prompts (Inject / Copy buttons).
+2. The **dashboard** with the card grid, category chips, and the Drive panel showing "Connected".
+3. The **onboarding** page (the guided Google setup).
+4. (Nice) An **inject in action** on the ChatGPT/Claude composer with a prompt dropped in.
+
+Capture at a 1280×800 window. On macOS: Shift-Cmd-4 then Space to grab a window, or set the Chrome window to 1280×800.
+
+---
+
+## Pre-submission checklist
+
+1. Build a fresh package: `npm -w apps/extension run package` → produces `apps/extension/promptvault-extension.zip`.
+2. Smoke-test locally: `chrome://extensions` → Developer mode → **Load unpacked** → select `apps/extension/dist/` → no errors; complete onboarding; inject a prompt into a textarea.
+3. Register/long in to the **Chrome Web Store Developer Dashboard** (one-time US$5 registration if you haven't).
+4. **Add new item** → upload `promptvault-extension.zip`.
+5. Fill **Store listing** (name, descriptions, category, language, screenshots, icon).
+6. Fill **Privacy** tab: single purpose, each permission justification, "remote code: No", privacy policy URL, and the data-use certifications above.
+7. **Account** tab: verify a contact email (required before publishing).
+8. Submit for review. First reviews typically take a few days. Because scopes are non-sensitive (`drive.file` + `email`), no separate OAuth verification is required.
+
+## After publishing
+- Put the published Web Store URL into `apps/web/src/config.js` (`EXTENSION_URL`) and the landing CTA so the website links to it.

apps/extension/manifest.json

@@ -1,15 +1,16 @@
 {
   "manifest_version": 3,
   "name": "PromptVault",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "Store reusable AI prompts in your own Google Drive and inject them into any text field.",
+  "homepage_url": "https://prompt-vault-01.web.app",
   "action": { "default_popup": "popup.html", "default_title": "PromptVault" },
   "options_page": "dashboard.html",
   "background": { "service_worker": "background.js" },
   "content_scripts": [
     { "matches": ["<all_urls>"], "js": ["content.js"], "run_at": "document_idle" }
   ],
-  "permissions": ["contextMenus", "storage", "scripting", "activeTab", "clipboardWrite", "identity", "alarms"],
+  "permissions": ["contextMenus", "storage", "clipboardWrite", "identity", "alarms"],
   "host_permissions": ["<all_urls>", "https://www.googleapis.com/*", "https://accounts.google.com/*"],
   "icons": { "16": "icon16.png", "48": "icon48.png", "128": "icon128.png" }
 }

apps/extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@promptvault/extension",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "private": true,
   "type": "module",
   "scripts": {

apps/extension/test/build-smoke.test.js

@@ -20,11 +20,14 @@ describe('build smoke', () => {
     }
   });
 
-  test('manifest.json is valid JSON with MV3 + required permissions', () => {
+  test('manifest.json is valid JSON with MV3 + the required (minimal) permissions', () => {
     const m = JSON.parse(readFileSync(p('manifest.json'), 'utf8'));
     expect(m.manifest_version).toBe(3);
-    for (const perm of ['contextMenus', 'storage', 'identity', 'alarms', 'scripting', 'activeTab', 'clipboardWrite']) {
+    for (const perm of ['contextMenus', 'storage', 'identity', 'alarms', 'clipboardWrite']) {
       expect(m.permissions).toContain(perm);
     }
+    // Trimmed for Web Store review — these are unused/redundant and must NOT be present.
+    expect(m.permissions).not.toContain('scripting');
+    expect(m.permissions).not.toContain('activeTab');
   });
 });

apps/web/index.html

@@ -66,7 +66,7 @@ <h2>How it works</h2>
     </section>
 
     <footer>
-      <div class="wrap">PromptVault · Free &amp; private · <a href="/app">Open the app</a></div>
+      <div class="wrap">PromptVault · Free &amp; private · <a href="/app">Open the app</a> · <a href="/privacy">Privacy</a></div>
     </footer>
   </div>
 </body>

apps/web/public/privacy.html

@@ -0,0 +1,95 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <link rel="icon" type="image/png" href="/favicon.png" />
+  <title>PromptVault — Privacy Policy</title>
+  <style>
+    :root { --accent:#185fa5; --line:#e4e4df; --ink:#1f2330; }
+    body { max-width: 760px; margin: 40px auto; padding: 0 20px; font: 16px/1.6 system-ui, sans-serif; color: var(--ink); }
+    h1 { margin-bottom: 4px; }
+    h2 { margin-top: 28px; }
+    .muted { color: #777; }
+    a { color: var(--accent); }
+    code { background:#f5f6f8; padding:1px 5px; border-radius:5px; }
+    hr { border:none; border-top:1px solid var(--line); margin:24px 0; }
+  </style>
+</head>
+<body>
+  <h1>PromptVault — Privacy Policy</h1>
+  <p class="muted">Last updated: 7 June 2026</p>
+
+  <p>
+    PromptVault is a prompt manager available as a website and a browser extension. It is built to be
+    <strong>private by design and to run without any backend server</strong>. This policy explains exactly
+    what data PromptVault touches and where it goes.
+  </p>
+
+  <h2>The short version</h2>
+  <ul>
+    <li>We operate <strong>no servers and no database</strong>. There is nothing for us to see, store, or sell.</li>
+    <li>Your prompts and any media you attach are stored in <strong>your own Google Drive</strong> and in your
+      browser's local storage — never on infrastructure we control.</li>
+    <li>We collect <strong>no analytics, no telemetry, and no advertising data</strong>.</li>
+    <li>The only network requests PromptVault makes are directly between your browser and
+      <strong>Google</strong> (for sign-in and Drive), after you choose to connect.</li>
+  </ul>
+
+  <h2>What data PromptVault handles</h2>
+  <ul>
+    <li><strong>Your prompts and metadata</strong> (titles, categories, tags, timestamps): stored in a
+      <code>vault.json</code> file inside a <code>PromptVault</code> folder in your Google Drive, and cached
+      locally in your browser (<code>chrome.storage.local</code> in the extension; IndexedDB on the web).</li>
+    <li><strong>Media you attach</strong> (e.g. images): uploaded as files to that same Google Drive folder.</li>
+    <li><strong>Your Google account email</strong>: shown in the UI so you know which account is connected.
+      It is read from Google and kept only in your browser's local storage.</li>
+    <li><strong>An OAuth access token</strong>: held only in your browser to call the Google Drive API on your
+      behalf. It is cleared when you disconnect/sign out.</li>
+  </ul>
+
+  <h2>Google account access (limited scope)</h2>
+  <p>
+    PromptVault requests the least-privilege scopes <code>drive.file</code> and <code>userinfo.email</code>.
+    The <code>drive.file</code> scope means PromptVault can <strong>only access files it creates</strong>
+    (your PromptVault folder) — it cannot see or touch any of your other Drive files. PromptVault's use of
+    information received from Google APIs adheres to the
+    <a href="https://developers.google.com/terms/api-services-user-data-policy" target="_blank" rel="noreferrer">Google API Services User Data Policy</a>,
+    including the Limited Use requirements.
+  </p>
+
+  <h2>What we do NOT do</h2>
+  <ul>
+    <li>We do not transmit your prompts or files to any server we operate (we have none).</li>
+    <li>We do not sell, rent, or share your data with third parties.</li>
+    <li>We do not use your data for advertising or to train models.</li>
+    <li>We do not track your browsing. The browser extension's content script only inserts a prompt's text
+      into the field you choose; it does not read or send page contents anywhere.</li>
+  </ul>
+
+  <h2>Browser extension permissions</h2>
+  <ul>
+    <li><code>storage</code> — cache your prompt library locally.</li>
+    <li><code>identity</code> — sign in to Google to connect your Drive.</li>
+    <li><code>contextMenus</code> — the right-click "Inject prompt" / "Save selection" menu.</li>
+    <li><code>clipboardWrite</code> — copy a prompt to the clipboard as a fallback when no text field is focused.</li>
+    <li><code>alarms</code> — periodically sync your library with your Drive.</li>
+    <li>Host access to all sites — required so you can insert a saved prompt into a text field on any website.
+      Page content is never read or collected.</li>
+  </ul>
+
+  <h2>Deleting your data</h2>
+  <p>
+    Your data lives in your Google Drive and your browser. To remove it: delete the <code>PromptVault</code>
+    folder from your Google Drive, and remove the extension / clear the site's browser storage. You can revoke
+    PromptVault's access at any time at
+    <a href="https://myaccount.google.com/permissions" target="_blank" rel="noreferrer">myaccount.google.com/permissions</a>.
+  </p>
+
+  <h2>Contact</h2>
+  <p>Questions about this policy: <a href="mailto:sumit@sumitagrawal.dev">sumit@sumitagrawal.dev</a>.</p>
+
+  <hr />
+  <p class="muted"><a href="/">← Back to PromptVault</a></p>
+</body>
+</html>